Guy Harris wrote:
On Sun, Feb 29, 2004 at 08:24:37PM +0100, Ulf Lamping wrote:
Do you really have a use case for this? (see below)
I don't, but I assume Laurent Deniel, who put that feature in, did, or
knew people who did, and I think I've seen other people asking how they
can do that - there might be stuff in the mail archives about this.
I think their use case is that they want to run a capture for a very
long time, but not to have a single giant capture file - they want the
file carved into smaller pieces, to cut the amount of data in a single
file and thus to make it less painful to, for example, process the file
in Ethereal.
(Late followup but back from holiday ...)
That's right.
I use the "one file" (i.e. only the packets of the last day or hour for instance)
and "0" (i.e. unlimited) features of the ring buffer in many situations and
in real world cases (e.g. to be able to save one compressed file of captured
data per hours or days according to the LAN traffic or capture filters).
This means that [t]ethereal is *never* stopped (well unless crashes or
memory leaks ... ;-(
The '0' in the GUI was only temporary since I wanted to have the core
features in place very quickly and without spending then too much time
in the GUI part ...
Refer also to:
http://www.ethereal.com/lists/ethereal-dev/200306/msg00184.html
Up to everyone to change the GUI in whole or in part, but be careful,
the current window (mix of stop conditions or different ring buffer
modes) allow a lot of combinations that might not be possible (or worst
labelled) in the different GUI proposed in the next mails of this thread ..
(still reading them).
Laurent
